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information Commissioner's Office 


Freedom of Information Act 2000 (FOIA) 


Decision notice 


Date: 18 April 2019 
Public Authority: Salford Royal NHS Foundation Trust 
Address: First Floor, Turnpike House 

631 Eccles New Road 

Salford 

M50 1SY 


Decision (including any steps ordered) 


1. The complainant has requested a variety of statistical information and 
information relating to his own care. 


2. The Commissioner’s decision is that Salford Royal NHS Foundation Trust 
(“the Trust”) does not hold some of the information within the scope of 
the request. Where it does hold information, it is entitled to rely upon 
section 21 (information accessible by other means) of FOIA in the 
manner it has done. The Trust is entitled to rely on section 12 (costs) to 
refuse some sections of the request, although it should have cited 
section 12(2) instead of section 12(1). The Trust is also entitled to rely 
on section 40(2) (personal information) to withhold some of the 
information within scope - although the Commissioner notes that it 
ought, more properly, to have relied upon section 40(5) to refuse to 
confirm or deny holding some of the information. The Commissioner also 
finds that the Trust failed to identify all the information it held within the 
scope of the request and failed to issue a refusal notice citing all the 
exemptions on which it later came to rely within 20 working days. The 
Trust therefore breached sections 10 and 17 of the FOIA. 


3. The Commissioner does not require any further steps to be taken. 
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Request and response 


4. On 22 January 2018, the complainant wrote to the Trust and requested 
information of the following description: 


“1J! All complaints or investigation disciplinary action carried out on 
the following: [Staff Member 1], [Staff Member 2], [Staff Member 
3], [Staff Member 4] 


[2] How many colon surgeries she has undertaken stent, total removal 
stoma, loop temporary or permanent [Staff Member 1] has carried 
out outcomes deaths etc. 


[3] A comparison of colorectal consultant surgeons at Salford Royal, 
Stents and Colon emergency surgery outcomes stoma and 
procedure undertaken 


[4] How many stomas were reversed successfully” 


5. The complainant followed up later the same day to add further parts to 
his request in the following terms: 


“"[5] A list of all doctors responsible for my care 

[6] I have not been informed what [Staff Member 5] qualification is. 

[7] How many stomas have to be re done within one week because of 
failure by [Staff Member 1] compared with colorectal surgeon 
[Staff Member 6] percentage and number [Staff Member 6] will do 


more surgeries 


[8] Complaints/investigation action against [Staff Member 7], [Staff 
Member 8] 


[9] and Salford royal regarding record keeping 


[10] and [Staff Member 2] identity no and present location or do i have 
to contact the royal college of surgeons.” [sic] 


1 The original request was not numbered in this way. The Commissioner has broken down 
the request into its component parts to make the analysis that follows easier to understand. 
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6. On 11 July 2018 - and following the intervention of the Commissioner - 
the Trust finally responded. It stated that it held no information within 
the scope of the request except for parts [5] - which it refused citing 
section 21 of the FOIA (reasonably accessible) - [6] and [10] - where, it 
said, it was withholding the information it did hold, as the information 
was exempt from disclosure under section 40(2) (third party personal 
data). The Trust also provided the complainant with some more general 
information, policies and statistics outside of the FOIA process. 


7. The complainant wrote back to the Trust on 12 July 2018. His letter was 
broad-ranging and covered multiple parts of the request including 
complaints about care standards, the use of his personal data and some 
parts of his original FOI requests. 


8. Following the further intervention of the Commissioner, the Trust finally 
completed its internal review on 27 January 2019. It maintained its 
position in relation to parts [2], [3], [4], [5], [6] and [7]. In respect of 
parts [1], [8] and [9] it now accepted that it may hold some information 
but that providing the information would exceed the cost limit and thus 
section 12 was engaged. In respect of element [10], it reversed its 
original position and disclosed the information it held. 


Scope of the case 


9. The complainant first contacted the Commissioner on 17 June 2018 to 
complain that he had not received a response and the Commissioner’s 
intervention was necessary to get the Trust to respond. 


10. Given the lengthy delay in responding to the request, when the Trust 
failed to complete its internal review within 20 working days, the 
Commissioner exercised her discretion and accepted the complaint for 
investigation without an internal review. 


11. At the outset of her investigation, the Commissioner asked the Trust to 
revisit its response to each element of the request and noted that the 
fact that information could not easily be provided did not mean that the 
information was not “held” for the purposes of the FOIA. The Trust failed 
to respond to this correspondence within a reasonable period of time 
and the Commissioner was therefore forced to issue an Information 
Notice compelling the Trust to respond. This prompted the Trust to 
complete an internal review on 27 January 2019. 


12. The Commissioner’s task in this notice is to: 


a. Determine the extent of the information which is held 
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b. Determine the extent to which the Trust is entitled to rely on the 
exemptions it has done to withhold information. 


c. Comment on the procedural elements of the way that the request 
was handled. 


Reasons for decision 


Parts [2], [3], [4] & [7] - Information not held 
13. Section 1(1) of the FOIA states that: 


Any person making a request for information to a public authority is 
entitled - 


(a) to be informed in writing by the public authority whether it holds 
information of the description specified in the request, and 

(b) if that is the case, to have that information communicated to 
him. 


14. The Commissioner has decided to group the parts of the request listed in 
the heading above together for the purpose of this decision notice 
because the reasoning as to why no information was provided within the 
scope of these parts is common to all four parts. 


15. In cases where a dispute arises over the extent of the recorded 
information that was held by a public authority at the time of a request, 
the Commissioner will consider the complainant’s evidence and 
arguments. She will also consider the actions taken by the authority to 
check that the information is not held and any other reasons offered by 
the public authority to explain why the information is not held. Finally, 
she will consider any reason why it is inherently likely or unlikely that 
information is not held. 


16. For clarity, the Commissioner is not expected to prove categorically 
whether the information is held, she is only required to make a 
judgement on whether the information is held on the civil standard of 
the balance of probabilities. 


17. All of these parts of the request relate in some way to “outcomes” data 
which the complainant is seeking. 


18. The Trust explained that it does not hold “outcomes” data in the way 
that the complainant is seeking. It records the type of medical 
intervention that was carried out but noted that “success” was a 
subjective judgement rather than a clinical definition. 
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The Trust noted that a patient’s medical notes might show that the 
patient died within a relatively short period of time following a medical 
intervention. However, that death might have occurred as a direct result 
of the surgery, the surgery might have been a contributory factor or 
death might have been caused by other factors. 


Whilst the Trust felt that it could, with an infinite amount of time, link 
medical interventions to “outcomes”, this would require clinicians to 
examine each individual file and make a clinical judgement as to 
whether a surgery was “successful” or not. This, it argued, would require 
the creation of new information. 


The Commissioner’s guidance on determining whether information is 
held states that a public authority will be deemed to “hold” information if 
that information can be collated from other data which the authority 
holds.? This would include, for example, collating a list of documents 
that it held (if no such list existed) or calculating an average from a 
dataset. 


However, from the arguments which the Trust has provided, it is clear 
that the precise information which the complainant has requested could 
not be obtained by mere collation of existing information. The 
information requested could only be obtained by presenting a collation 
of information to a clinician and having that clinician exercise their 
professional judgement. Because the use of expert judgement is 
involved, this requires the creation of new information to satisfy the 
request and therefore the Commissioner concludes that the Trust does 
not hold the specified information in respect of these elements of the 
request. 


Part [10] — No further information held 


23. 


24. 


Following the Commissioner’s intervention, the Trust disclosed the GMC 
registration number of Staff Member 2 as, whilst it accepted this would 
be the individual’s personal data, the information was already in the 
public domain. 


In relation to the individual’s current whereabouts, the Trust stated that 
it does not keep a record of where its ex-staff members were employed 
as there is no business need to do so. Whilst it may occasionally receive 
requests for professional references, it cannot know whether the 


2 https://ico.org.uk/media/for- 


organisations/documents/1169/determining whether information is held foi eir.pdf 
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individual involved took up the post. The Commissioner considers this to 
be a reasonable explanation as to why the information is not held. 


The Commissioner is therefore satisfied that the Trust has disclosed all 
the information which it holds within the scope of this element of the 
request. 


Part [5] - Section 21 


26. 


27. 


28. 


29. 


Section 21 of the FOIA provides an exemption for information that is 
reasonably to the applicant through other means. In this case, the 
position of the Trust was that the information falling within the scope of 
the request was reasonably accessible to the applicant as it had been 
disclosed to him previously. 


The Trust explained that it did not hold the precise information within 
this element of the request. However, it also explained that it had 
responded to a SAR, submitted by the complainant, for his own medical 
notes. The Trust noted that the names of most of the doctors involved in 
the complainant’s care would be visible in the medical notes and that 
these were reasonably accessible to the complainant. 


The Trust accepted that not every clinician who had been involved with 
the complainant would have their name recorded in the medical notes, 
but argued that that information would not be held, in recorded form, 
anywhere else either. 


The Commissioner is satisfied that the Trust holds no further information 
that would fall within the scope of this element of the request beyond 
that which has been disclosed through the SAR process. As that 
information had already been provided to the complainant, the 
Commissioner accepts that it was available to him and that section 21 
was engaged. The Trust was not, therefore, obliged to disclose that 
information to the complainant again. The Commissioner also notes that 
even if the Trust did hold any additional information, it would be the 
complainant’s own personal data and hence exempt from disclosure 
under FOIA under section 40(1). 


Part [6] - Section 40(2) 


30. 


3i. 


As Trust’s refusal of the request was after 25 May 2018, the date the 
new Data Protection Act 2018 (“DPA 2018”) and General Data Protection 
Regulation (GDPR) legislation came into force, the Commissioner 
considers that the DPA 2018 applies. 


Section 40(2) of the FOIA provides that information is exempt from 
disclosure if it is the personal data of an individual other than the 
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requester and where one of the conditions listed in section 40(3A)(3B) 
or 40(4A) is satisfied. 


In this case the relevant condition is contained in section 40(3A)(a)?. 
This applies where the disclosure of the information to any member of 
the public would contravene any of the principles relating to the 
processing of personal data (“the DP principles”), as set out in Article 5 
of the General Data Protection Regulation (“GDPR”). 


The first step for the Commissioner is to determine whether the withheld 
information constitutes personal data as defined by the Data Protection 
Act 2018 (‘DPA’). If it is not personal data then section 40 of the FOIA 
cannot apply. 


Secondly, and only if the Commissioner is satisfied that the requested 
information is personal data, she must establish whether disclosure of 
that data would breach any of the DP principles. 


Is the information personal data? 


35. 


36. 


37. 


38. 


39. 


Section 3(2) of the DPA defines personal data as: 


“any information relating to an identified or identifiable living 
individual”. 


The two main elements of personal data are that the information must 
relate to a living person and that the person must be identifiable. 


An identifiable living individual is one who can be identified, directly or 
indirectly, in particular by reference to an identifier such as a name, an 
identification number, location data, an online identifier or to one or 
more factors specific to the physical, physiological, genetic, mental, 
economic, cultural or social identity of the individual. 


Information will relate to a person if it is about them, linked to them, 
has biographical significance for them, is used to inform decisions 
affecting them or has them as its main focus. 


Any information which the Trust held in respect of this element of the 
request would be the personal data of Staff Member 5 as it would clearly 
relate to that individual and provide biographical information about 
them. 


3 As amended by Schedule 19 Paragraph 58(3) DPA. 
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In the circumstances of this case, the Commissioner is satisfied that, 
given the wording of the request, any information the Trust held would 
relate to Staff Member 5. She is satisfied that this information both 
relates to and identifies Staff Member 5. This information therefore falls 
within the definition of “personal data” in section 3(2) of the DPA. 


The fact that information constitutes the personal data of an identifiable 
living individual does not automatically exclude it from disclosure under 
the FOIA. The second element of the test is to determine whether 
disclosure would contravene any of the DP principles. 


The most relevant DP principle in this case is principle (a). 
Would disclosure contravene principle (a)? 
Article 5(1)(a) of the GDPR states that: 


“Personal data shall be processed lawfully, fairly and in a transparent 
manner in relation to the data subject”. 


In the case of an FOIA request, the personal data is processed when it is 
disclosed in response to the request. This means that the information 
can only be disclosed if to do so would be lawful, fair and transparent. 


In order to be lawful, one of the lawful bases listed in Article 6(1) of the 
GDPR must apply to the processing. It must also be generally lawful. 


Lawful processing: Article 6(1)(f) of the GDPR 


The Commissioner considers that the lawful basis most applicable is 
basis 6(1)(f) which states: 


“processing is necessary for the purposes of the legitimate interests 
pursued by the controller or by a third party except where such 
interests are overridden by the interests or fundamental rights and 
freedoms of the data subject which require protection of personal 
data, in particular where the data subject is a child”. 


4 Article 6(1) goes on to state that:- 


“Point (f) of the first subparagraph shall not apply to processing carried out by public 
authorities in the performance of their tasks”. 


However, section 40(8) FOIA (as amended by Schedule 19 Paragraph 58(8) DPA) provides 
that: - 


e 
Reference: FS50757134 1cO 
© 


47. 


48. 


information Commissioner's Office 


In considering the application of Article 6(1)(f) of the GDPR in the 
context of a request for information under the FOIA, it is necessary to 
consider the following three-part test:- 


i) Legitimate interest test: Whether a legitimate interest is being 
pursued in the request for information; 


ii) Necessity test: Whether disclosure of the information is 
necessary to meet the legitimate interest in question; 


iii) Balancing test: Whether the above interests override the 
legitimate interest(s) or fundamental rights and freedoms of the 
data subject. 


The Commissioner considers that the test of ‘necessity’ under stage (ii) 
must be met before the balancing test under stage (iii) is applied. 


Legitimate interests 


49. 


50. 


51: 


In considering any legitimate interest(s) in the disclosure of the 
requested information under the FOIA, the Commissioner recognises 
that such interest(s) can include broad general principles of 
accountability and transparency for their own sakes, as well as case- 
specific interests. 


Further, a wide range of interests may be legitimate interests. They can 
be the requester’s own interests or the interests of third parties, and 
commercial interests as well as wider societal benefits. They may be 
compelling or trivial, but trivial interests may be more easily overridden 
in the balancing test. 


The Commissioner considers that both patients and potential patients 
would have a legitimate interest in knowing that the staff treating them 
are appropriately qualified for that role. 


“In determining for the purposes of this section whether the lawfulness principle in 
Article 5(1)(a) of the GDPR would be contravened by the disclosure of information, 
Article 6(1) of the GDPR (lawfulness) is to be read as if the second sub-paragraph 
(dis-applying the legitimate interests gateway in relation to public authorities) were 
omitted”. 
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Is disclosure necessary? 


52. 


53. 


54. 


55. 


56. 


57. 


‘Necessary’ means more than desirable but less than indispensable or 
absolute necessity. Accordingly, the test is one of reasonable necessity 
and involves consideration of alternative measures which may make 
disclosure of the requested information unnecessary. Disclosure under 
the FOIA must therefore be the least intrusive means of achieving the 
legitimate aim in question. 


In the circumstances of this particular case, the Commissioner considers 
that public disclosure of the precise details of a particular staff member's 
qualifications is not necessary to satisfy any legitimate interest. 


The Commissioner particularly notes that the Trust has, in this instance, 
given the complainant an assurance that Staff Member 5 is appropriately 
qualified. She further notes that the General Medical Council has a 
searchable register of doctors and their fitness to practice. The 
Commissioner considers that this a less intrusive means of achieving the 
legitimate interest than disclosure under the FOIA. 


The Commissioner therefore concludes that publication of Staff Member 
5’s qualifications to the world at large (which is what is required under 
the FOIA) is not the least intrusive method of achieving the legitimate 
interest. Such processing is thus not necessary. 


As the Commissioner has decided in this case that disclosure is not 
necessary to meet the legitimate interest in disclosure, she has not gone 
on to conduct the balancing test. As disclosure is not necessary, there is 
no lawful basis for this processing and it is thus unlawful. Disclosure 
does not therefore meet the requirements of principle (a). 


Given the above conclusion that disclosure would be unlawful, the 
Commissioner considers that she does not need to go on to separately 
consider whether disclosure would be fair or transparent. Section 40(2) 
is engaged in relation to part [6] of the request. 


Part [8] - Section 40(2) 


58. 


59. 


The Trust argued that any information which it held in relation to 
“investigations” would be contained within the personnel files of the 
individuals involved and therefore “section 40(2)” of the FOIA would be 
engaged. 


The Commissioner notes that the Trust did not issue an explicit 
confirmation or denial that it held any information within the scope of 
this element of the request - however she would not have expected it to 
do so. The Commissioner considers that a confirmation or a denial that 
information about an investigation is held is an effective confirmation 
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that such an investigation has taken place. As information within the 
scope of this element can only relate to the individuals concerned, a 
confirmation or a denial would, in itself, be the personal data of the 

individuals concerned. 


Section 40(5B)(a)(i) of FOIA provides that the duty to confirm or deny 
whether information is held does not arise if it would contravene any of 
the principles relating to the processing of personal data set out in 
Article 5 of the General Data Protection Regulation EU2016/679 (‘GDPR’) 
to provide that confirmation or denial. 


Therefore, for the Trust to be entitled to rely on section 40(5B) of FOIA 
to refuse to confirm or deny whether it holds information falling within 
the scope of the request the following two criteria must be met: 


e Confirming or denying whether the requested information is held 
would constitute the disclosure of a third party’s personal data; 
and 

e Providing this confirmation or denial would contravene one of the 
data protection principles. 


The Commissioner has generally taken the view that data about 
complaints relates to the work performance of the individual who is the 
subject of those complaints. Where complaints are found to have merit, 
or where improvement/learning opportunities are identified, this process 
should take place between the employee and employer. Disclosure 
under FOIA is not a proportionate method of addressing any legitimate 
interest which may arise. 


Disclosure under the FOIA is considered to be disclosure to the world at 
large and not to the complainant specifically. It is the equivalent of the 
Trust publishing the information on its website. 


The Commissioner considers that the arguments at paragraphs 43-57 
above apply equally (if not more strongly) to a confirmation or a denial 
that complaints or investigations data is held on the individuals 
concerned. 


The Commissioner notes that staff members who had never been the 
subject of a complaint might have no issue with that information being 
disclosed. However, the Trust must consider the “mosaic effect” of 
denying that information is held in relation to some staff members, 
should a similar request be made about a staff member who had been 
the subject of a complaint. A public authority which denied information 
was held in such a scenario would undermine its own future ability to 
neither confirm nor deny holding information, as a reasonable inference 
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could be drawn that the public authority would only refuse to confirm or 
deny holding information if it were held. 


66. It is not clear from the Trust’s refusal notice or internal review whether 
it is in fact wishing to rely on an exemption from the duty to confirm or 
deny. However, the Commissioner is also responsible for regulating data 
protection legislation and, as such, takes her responsibility to protect 
personal data seriously when considering information which can be 
disclosed under the FOIA. She will therefore step in and apply 
exemptions herself to prevent disclosure of personal data where she 
considers this necessary in order to avoid a breach of data protection 
legislation. 


67. In the Commissioner’s view, to the extent that there is a legitimate 
interest in transparency relating to complaints data, that interest is met 
by the Trust’s own internal management and audit processes having 
access to the data. Issuing a confirmation or denial would therefore not 
be the least intrusive method of achieving the legitimate interest. It thus 
cannot be necessary for achieving that interest and therefore cannot be 
lawful. Provision of the confirmation or denial would not therefore meet 
the requirements of principle (a). 


68. The Commissioner’s view is that the Trust was entitled to rely on Section 
40(5B)(a)(i) to neither confirm nor deny holding information within the 
scope of element [8] of the request and should have done so in the 
circumstances. 


Parts [1] and [9] - Section 12 
70. Section 12 of the FOIA states that: 


(1) Section 1(1) does not oblige a public authority to comply with 
a request for information if the authority estimates that the 
cost of complying with the request would exceed the 
appropriate limit. 


(2) Subsection (1) does not exempt the public authority from its 
obligation to comply with paragraph (a) of section 1(1) unless 
the estimated cost of complying with that paragraph alone 
would exceed the appropriate limit. 


71. The “Appropriate Limit” is defined in the Freedom of Information and 
Data Protection (Appropriate Limit and Fees) Regulations 2004 (“the 
Regulations”) and is set at £450 for a public authority such as the Trust. 
The Regulations also state that staff time should be notionally charged 
at a flat rate of £25 per hour, giving an effective time limit of 18 hours. 


12 


e 
Reference: FS50757134 1cO 
© 


information Commissioner's Office 


72. When estimating the cost of complying with a request, a public authority 
is entitled to take account of time or cost spent in: 


(a) determining whether it holds the information, 


(b) locating the information, or a document which may contain the 
information, 


(c) retrieving the information, or a document which may contain the 
information, and 


(d) extracting the information from a document containing it. 


73. A public authority does not have to make a precise calculation of the 
costs of complying with a request; instead only an estimate is required. 
However, it must be a reasonable estimate. In accordance with the 
First-Tier Tribunal in the case of Randall v IC & Medicines and Healthcare 
Products Regulatory Agency EA/2007/0004, the Commissioner considers 
that any estimate must be “sensible, realistic and supported by cogent 
evidence”’. The task for the Commissioner in a section 12 matter is to 
decide whether the public authority made a reasonable estimate of the 
cost of the request. 


74. The Trust explained that it recorded each complaint against the name of 
the person who submitted the complaint and not against the individual 
member(s) of staff involved or the subject matter. 


75. In order to identify the requested information, the Trust argued that it 
would have to check each complaint file manually to determine whether 
it was about record-keeping or any of the members of staff involved. 
This would have to be done for each of the 1,808 complaints it had 
recorded between 1 January 2014 and 18 December 2018. 


76. The Commissioner is satisfied that, because of the way that complaints 
are recorded, the Trust would have to search all its complaint files in 
order to establish definitively the extent of the information it held 


77. The Trust estimated that this would take an average of five minutes per 
complaint file and, on that basis, complying with the request would take 
in excess of 150 hours of staff time (£3,750). The Trust did not appear 
to have carried out a sampling exercise to confirm this, but the 
Commissioner notes that, even if the Trust were able to reduce the time 


> http://informationrights.decisions.tribunals.gov.uk/DBFiles/Decision/i136/Ra 
ndall.pdf 
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taken to just one minute per casefile, the search would still take 30 
hours to complete - which would exceed the appropriate limit. 


78. The Trust stated that it was relying on section 12(1) of the FOIA to 
withhold the information. Section 12(1) does not spare a public 
authority from its duty to confirm or deny holding information. In its 
internal review response, the Trust stated that: 


“There is the possibility that the Trust does hold details of 
complaints which relate to the services provided by the staff 
mentioned.” 


79. In the Commissioner’s view, the above statement falls short of the Trust 
complying with its section 1(1)(a) duty to confirm or deny holding 
information. However, she also notes that the overwhelming majority of 
the time required to comply with the request would be taken up by 
determining the extent of the information that is held. The 
Commissioner therefore finds that the Trust was entitled to rely on 
section 12(2) of the FOIA to release it from its duty to confirm or deny 
holding information. 


80. Even if the Trust had been able to issue a confirmation or a denial that 
information was held without exceeding the cost limit, in the 
Commissioner’s view, the Trust should still not have done so in respect 
of part [1] of the request, as a confirmation or a denial would involve a 
disclosure of the personal data of the individuals involved. The analysis 
above in relation to part [8] would apply equally to part [1] and 
therefore the Trust would be entitled to rely on section 40(5B)(a)(i) to 
neither confirm nor deny holding information. 


Procedural matters — Sections 10 and 17 


81. Section 10 of the FOIA states that a public authority must comply with 
its section 1 duties “promptly and in any event not later than the 
twentieth working day following the date of receipt.” 


82. Section 17 of the FOIA states that: 


(1) A public authority which, in relation to any request for 
information, is to any extent relying on a claim that any 
provision of Part II relating to the duty to confirm or deny is 
relevant to the request or on a claim that information is 
exempt information must, within the time for complying with 
section 1(1), give the applicant a notice which— 


(a) states that fact, 


(b) specifies the exemption in question, and 
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(c) states (if that would not otherwise be apparent) why the 
exemption applies. 


(5) A public authority which, in relation to any request for 
information, is relying on a claim that section 12 or 14 applies 
must, within the time for complying with section 1(1), give the 
applicant a notice stating that fact. 


83. The Trust did not issue its response to the request until seven months 
after the request was first made - and only after the Commissioner had 
intervened. The Commissioner considers that the Trust’s initial response 
incorrectly claimed that information was not held, incorrectly withheld 
some information and did not state all the exemptions upon which the 
Trust later claimed to rely. 


84. The Commissioner therefore concludes that the Trust failed to discharge 
its section 1(1) duty adequately within 20 working days and issued a 
refusal notice which was neither adequate nor within the time limit. 


85. The Trust thus breached both section 10 and section 17 of the FOIA. 


Other Matters 


86. Whilst there is no statutory time limit, within FOIA, for internal reviews 
to be completed, the Commissioner considers that they should normally 
take no more than 20 working days to complete and should never take 
more than 40 working days. 


87. In this particular case, the Trust took six months to complete an internal 
review and only did so following an intervention by the Commissioner. 
The Commissioner finds such a long delay (particularly as it followed a 
delay in responding to the request initially) to be unacceptable. 
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Right of appeal 


88. Either party has the right to appeal against this decision notice to the 
First-tier Tribunal (Information Rights). Information about the appeals 
process may be obtained from: 


First-tier Tribunal (Information Rights) 
GRC & GRP Tribunals, 

PO Box 9300, 

LEICESTER, 

LE1 8DJ 


Tel: 0300 1234504 

Fax: 0870 739 5836 

Email: GRC@hmcts.gsi.gov.uk 

Website: www. justice.gov.uk/tribunals/general-regulatory- 


chamber 


89. If you wish to appeal against a decision notice, you can obtain 
information on how to appeal along with the relevant forms from the 
Information Tribunal website. 


90. Any Notice of Appeal should be served on the Tribunal within 28 
(calendar) days of the date on which this decision notice is sent. 


SIQWGG) a a 


Ben Tomes 

Team Manager 

Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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